Splunk Search

Unable to rename _time as Time

wuming79
Path Finder

Hi,

I'm trying to rename _time as Time so that it will display the timestamp in YYYY-MM-DD HH:MM:SS. But when I do rename _time AS "Time" | table Time, it will show the time as Epoch time which was the original format extracted from the log file. How do I rename and table it correctly?

Tags (1)
0 Karma
1 Solution

BlueSocket
Communicator

I suggest that you don't do a rename of _time, try using an eval to add "Time" and then remove the _time with fields -, such as;

| eval Time = strftime(_time, "%Y-%d-%m %H:%M:%S") | fields - _time | table Time

That works for me.

View solution in original post

wuming79
Path Finder

Hi Guys,

I just realized after using the suggested formats, my earliest to latest timestamp is from right to left instead of the normal left to right. How can I reversed this to go from left to right?

How do I also make the timestamp display on the x-axis? There is only label rotation in x-axis format.alt text

0 Karma

woodcock
Esteemed Legend

The _time field is very special in a number of ways and one of them is that it automatically does this under the sheets:

| fieldformat _time = strftime(_time, <YourLocalRegionTimeFormatStringHere>)

You can do the same like this:

| rename _time AS Time
| fieldformat Time = strftime(Time, "%m/%d/%Y %H:%M:%S")

rjgreg
Explorer

@woodcock    I have been dragging though a ton of these threads trying to find a simple way to fix how my field _time output information.  I just wanted the date, so I took off the time aspect of your command and BOOM. Thank you.

| rename _time AS Date
| fieldformat Date = strftime(Date, "%Y-%m-%d")

Output:

Date

2021-10-01

Tags (1)
0 Karma

wuming79
Path Finder

Thanks Guys!

0 Karma

BlueSocket
Communicator

I suggest that you don't do a rename of _time, try using an eval to add "Time" and then remove the _time with fields -, such as;

| eval Time = strftime(_time, "%Y-%d-%m %H:%M:%S") | fields - _time | table Time

That works for me.

woodcock
Esteemed Legend

Please see my other answer below; the way to make it exactly the same is with fieldformat, not with eval.

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi wuming79,

you can't rename the _time field without getting the value all f*cked up.

Instead do something like this:

yoursearch | eval TIME=strftime(_time, "%d-%m-%Y %H:%M:%S") | table TIME | rename TIME AS whateveryouwantittobe
0 Karma

cmerriman
Super Champion

try to do an |eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")|table time...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...